WebApp Sec mailing list archives
RE: Cross Site Cooking
From: "Evans, Arian" <Arian.Evans () fishnetsecurity com>
Date: Tue, 31 Jan 2006 17:12:51 -0600
Checksums will not stop Session Fixation attacks. (unless you only hand out session cookies + checksums to unique logged in users, but then why not make your cookie your checksum?) btw// most browsers in the wild adhere more to RFC 2109 as of the last time I did any meaningful testing, which was early 2005: http://www.ietf.org/rfc/rfc2109.txt There are some things like cookie2 stuff that are in 2965 that are inconsistently supported across browsers. I played with a number of this like pathing to get my head around the differences since it seems like less and less new developers understand what the cookie is (due to framework session object abstraction I suspect). The bottom line is that the attack Michael described is "Session Fixation" via session token in a cookie, which is pretty well covered by the Acros whitepaper and followed up by "Session Riding". Definitely interesting information by Michael. I am noticing all the browsers (7, FF 1.5) are tightening up a bit in what is permissible with cookies and script. Keep an eye out for our WAF project which transparently turns your cookied (?) sessions into cookieless sessions with some anti-xss benefits. Really it is probably boringly blatantly obvious to anyone on this list, and I really suspect the functionality will wind up in frameworks in the long run.... -ae
-----Original Message----- From: john-secfocus () o-rourke org [mailto:john-secfocus () o-rourke org] Sent: Tuesday, January 31, 2006 2:59 AM To: webappsec () securityfocus com Subject: Re: Cross Site Cooking It's probably better referring to the cookies RFC (ftp://ftp.rfc-editor.org/in-notes/rfc2965.txt) rather than a very old article (http://www.ciac.org/ciac/bulletins/i-034.shtml). The RFC doesn't mention anything about numbers of dots and specific domains. Although it's all definitely a security risk, there's no way all vendors would change the mechanism without keeping backwards compatibility, it would cause chaos. So with my sites I always put a checksum in the cookie data, which allows the website to be certain no clients have altered the data manually. -------------------------------------------------------------- ----------- This List Sponsored by: Watchfire Watchfire's AppScan is the industry's first and leading web application security testing suite, and the only solution to provide comprehensive remediation tasks at every level of the application. See for yourself. Download AppScan 6.0 today. https://www.watchfire.com/securearea/appscansix.aspx?id=701300
000003Ssh -------------------------------------------------------------------------- ------------------------------------------------------------------------- This List Sponsored by: Watchfire Watchfire's AppScan is the industry's first and leading web application security testing suite, and the only solution to provide comprehensive remediation tasks at every level of the application. See for yourself. Download AppScan 6.0 today. https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh --------------------------------------------------------------------------
Current thread:
- Cross Site Cooking Michal Zalewski (Jan 28)
- <Possible follow-ups>
- RE: Cross Site Cooking Amit Klein (AKsecurity) (Jan 29)
- RE: Cross Site Cooking Michal Zalewski (Jan 30)
- Re: Cross Site Cooking Aman Raheja (Jan 31)
- Re: Cross Site Cooking Michal Zalewski (Feb 02)
- Re: Cross Site Cooking john-secfocus (Jan 31)
- Re: Cross Site Cooking Erwan Legrand (Jan 31)
- Re: Cross Site Cooking Michal Zalewski (Jan 31)
- RE: Cross Site Cooking Evans, Arian (Jan 31)